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IN THE CLAIMS ; 

Please amend claims 1-3, 5, 7, 9, 12-16, 18 and 21 as 
indicated below. 

Please add claims 22-24 as indicated below. 

A listing of the status of all claims 1-24 in the present 
patent application is provided below. 

1 (Currently Amended) . A method for tracing source addresses of 
packets, the method comprising: 

receiving a current packet at a network element; 

identifying at least part of a source address of a — the 
current p acket ; 

querying a storage module of the network element to 
identify at least one source address of a previously received 
packet ; 

determining whether the at least part of the source address 
of the current packet m atches at least part of the at least one 
source address of the previously received packet recorded within 
a predetermined time period prior to arrival of the packet ; and 

routing the current packet to a network element if the at 
least part of the source address of the current packet m atches 
at least part of the at least one source address of the 
previously received packet recorded — within — the — predetermined 
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time period prior to tho arrival of the packet . 

2 (Currently Amended) . The method according to claim 1, where 
the at least one source address of the previously received 
packet is recorded in a hierarchical data structure , wherein the 
hierarchical data structure is based at least in part on a 
plurality of classes of subnet . 

3 (Currently Amended) . The method according to claim 1, where a 
Last Time Seen (LTS) value associated with each of the at least 
one source address of the previously received packet is 
recorded. 

4 (Previously Presented) . The method according to claim 1, 
further comprising: 

recording an arrival time of the packet. 

5 (Currently Amended) . The method according to claim 1, further 
comprising : 

routing the current packet to the network element with a 
warning if the at least part of the source address of the 
current packet does not match at least part of the at least one 
source address of the previously received packet recorded within 
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fehe — predetermined — time — period — prior — fee — fete — arrival — ef — fehe 

recording the at least part of the source address of the 
current packet and ail — arrival — reception time of the current 
packet . 

6 (Original) . The method according to claim 5, where the 
warning is recorded in a read-only medium. 

7 (Currently Amended) . The method according to claim 1, further 
comprising issuing a warning and discarding the current p acket 
if the at least part of the source address of the current packet 
does not match at least part of the at least one source address 

of the previously received packet recorded within fehe 

predetermined time period prior to the arrival of the packet . 

8 (Original) . The method according to claim 7, where the 
warning is recorded in a read-only medium. 

9 (Currently Amended) . The method according to claim 1, where 
the source address of the current packet is an internet protocol 
(IP) address. 
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10 (Cancelled) . 

11 (Previously Presented) . At least one processor readable 
medium for storing a computer program of instructions configured 
to be readable by at least one processor for instructing the at 
least one processor to execute a computer process for performing 
the method as recited in claim 1. 

12 (Currently Amended) . A system for tracing source addresses 
of packets comprising a-t — least — one a first network element for 
receiving a current packet , where the at least one first network 
element comprises: 

a processor module that identifies at least part of a 
source address of a — the current packet, queries to identify at 
least one source address of a previously received packet, 
determines whether the at least part of the source address of 
the current packet matches at least part of the at least one 
source address of the previously received packet recorded within 
a predetermined time period prior to arrival — &€ — the packet , and 
routes the current packet to a second network element if the at 
least part of the source address of the current packet matches 
at least part of the at least one source address of the 
previously received packet recorded — within — the — predetermined 
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time period prior to the arrival of the packet ; and 

a storage module that stores the at least one source 

address of the previously received packet recorded — within — a 

predetermined time period prior to arrival of the packet . 

13 (Currently Amended). The system according to claim 12, where 
the at least one source address of the previously received 
packet is recorded in a hierarchical data structure , wherein the 
hierarchical data structure comprises a plurality of classes of 
subnet . 

14 (Currently Amended) . The system according to claim 12, where 
a Last Time Seen (LTS) value associated with each of the at 
least one source address of the previously received packet is 
recorded. 

15 (Currently Amended). The system according to claim 12, where 
the processor module is further adapted to record aft — arrival 
reception time of the current packet . 

16 (Currently Amended) . The system according to claim 12, where 
the processor module is further adapted to: 

route the current packet to the second network element with 
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a warning if the at least part of the source address of the 

current packet does not match at least part of the at least one 

source address of the previously received packet recorded within 

fehe — predetermined — time — period — prior — fee — the — arrival — &€ — fehe 

record the at least part of the source address of the 
current packet and an — arrival — reception time of the current 
packet . 

17 (Original). The system according to claim 16, where the 
warning is recorded in a read-only medium. 

18 (Currently Amended). The system according to claim 12, where 
the processor module is further adapted to issue a warning and 
discard the current packet if the at least part of the source 
address of the current packet does not match at least part of 
the at least one source address of the previously received 
packet recorded within — fehe — predetermined — time — period prior — fee 
the arrival of the packet . 

19 (Original) . The system according to claim 18, where the 
warning is recorded in a read-only medium. 
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20 (Currently Amended). The system according to claim 12, where 
the source address of the current packet is an internet protocol 
(IP) address. 

21 (Currently Amended) . A system for tracing source addresses 
of packets, the system comprising: 

means for receiving a current packet; 

means for identifying at least part of a source address of 
a — the current packet ; and 

means for querying a storage module to identify at least 
one source address of a previously received packet; 

means for determining whether the at least part of the 
source address of the current packet matches at least part of 
the at least one source address of the previously received 
packet recorded — within — a — predetermined — time — period — prior — to 
arrival of the packet ; and 

means for routing the current packet to a network element 
if the at least part of the source address of the current packet 
matches at least part of the at least one source address of the 
previously received packet recorded — within — the — predetermined 
time period prior to the arrival of the packet . 

22 (New) . The method according to claim 1, wherein the at least 
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one source address of the previously received packet is recorded 

within a predetermined time period prior to receiving the 

current packet . 

23 (New). The method according to claim 2, wherein the 
plurality of classes of subnet comprises at least one of a class 
A subnet, a class B subnet, and a class C subnet, wherein the 
class A subnet comprises a first octet of the at least one 
source address recorded, the class B subnet comprises a second 
octet of the at least one source address recorded, and the class 
C subnet comprises a third octet of the at least one source 
address recorded. 

24 (New) . The method according to claim 23, wherein determining 
whether the at least part of the source address of the current 
packet matches at least part of the at least one source address 
of the previously received packet comprises comparing the at 
least part of the source address of the current packet with at 
least one of the plurality of classes of subnet of the at least 
one source address of the previously received packet. 
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